Re: Third-Party Web Tracking: Policy and Technology Paper outlining harms of tracking

Shane,

Sorry but I disagree on the three points you made:

· No harm ever came to users 
When the judge ruled in favor of Viacom, Youtube users really though that the logs would be shared with viacom. 12 terabytes of raw logs probably contain a lot of entries. There was a real harm here. Just check people reactions when tue decision was taken http://www.wired.com/threatlevel/2008/07/judge-orders-yo/#disqus_thread.
Furthermore, Viacom was "nice" enough to not require the full logs and agreed to get only an anomyzed version (https://www.eff.org/deeplinks/2008/07/viacom-narrows-request-youtube-information). But I think there was only little Youtube could do at that time to not share the logs.


· Following a market’s Legal system should not be seen as a failure of DNT 
I believe you're missing the irony of this case, the judge refereed to Google claims about IP addresses (see https://www.eff.org/deeplinks/2008/07/court-ruling-will-expose-viewing-habits-youtube-us). If Youtube had not kept the full IP addresses in clear or had deleted logs after X months, the trial outcome would have been different.
Again, in the end youtube "just" shared anonymized data but they should have kept anonymized logs from the beginning. Should they have done so, they would not have to rely an Vicaom goodwill as they could have shared only what they had.

· This data would have fallen under 1 st party rules (widget “meaningful interaction” after pressing the PLAY button) 
If autoplay is ON there can be no meaningful interaction so youtube is by all definitions a third party. 


For these reasons, I believe this is a valid example and I'd be happy to discuss it more.

Thank you,

Vincent


----- Mail original -----
De: "Shane Wiley" <wileys@yahoo-inc.com>
À: "Vincent Toubiana" <v.toubiana@free.fr>
Cc: "Alan Chapell" <achapell@chapellassociates.com>, "Jeffrey Chester" <jeff@democraticmedia.org>, public-tracking@w3.org, "Jonathan Mayer" <jmayer@stanford.edu>
Envoyé: Vendredi 12 Octobre 2012 01:27:06
Objet: RE: Third-Party Web Tracking: Policy and Technology Paper outlining    harms of tracking




Vincent, 



I don’t believe that’s a valid use case for this particular situation for the following reasons: 



· No harm ever came to users 

· Following a market’s Legal system should not be seen as a failure of DNT 

· This data would have fallen under 1 st party rules (widget “meaningful interaction” after pressing the PLAY button) 



Other examples? 



- Shane 





From: Vincent Toubiana [mailto:v.toubiana@free.fr] 
Sent: Thursday, October 11, 2012 2:26 PM 
To: Shane Wiley 
Cc: Alan Chapell; Jeffrey Chester; public-tracking@w3.org; Jonathan Mayer 
Subject: Re: Third-Party Web Tracking: Policy and Technology Paper outlining harms of tracking 




On 10/11/2012 10:36 PM, Shane Wiley wrote: 



Again – please help us understand real-world, tangible harms to consumers from the existence of data attached to pseudo/anonymous identifiers that is not used to directly alter a user’s experience (no profiling/targeting). We’ve discussed breach concerns and government intrusion but have no documented cases – are there others? 



Thank you, 

Shane 


HI Shane and Alan, 

I think I have another documented case: the Youtube vs Viacom where Youtube almost had to share pesudonymous data (including IP addresses) with Viacom. It is relevant because Youtube may act as a third party (i.e. an autostarting video embedded in an iframe, see Viacom claims below). Fortunately the two companies reached an agreement, but that was very close. 
If I remeber correctly, Youtube might have been forced to disclose all logs, because IP addresses were (according to Google policy) not identifiable information. Unfortunately, Youtube kept a lot of data (12 terabytes) and a shorter retention period would have certainly helped. 

How would that be translated in permitted uses? Ultimately to address this issue, there should be no log retention and no permitted uses. More realistically, I guess that anything that would result in a shorter retention period and data minimization would help in such case. That's how I interpret permitted uses: less data kept for a shorter period of time so that such data disclosure (while still being an issue) would have less dramatic effect. In the long term, these retention period should get even shorter if data scientist come up with scalable tools that can provide the same functionality with less data. 

Please find below some reference to the Viacom vs Youtube (from http://www.zdnet.com/blog/btl/youtube-vs-viacom-googles-ip-wins-users-lose/9242 ). 

I hope this answers your question. 


Vincent 




Plaintiffs seek all data from the Logging database concerning each time a YouTube video has been viewed on the YouTube website or through embedding on a third-party website. They need the data to compare the attractiveness of allegedly infringing videos with that of non-infringing videos. A markedly higher proportion of infringing-video watching may bear on plaintiffs’ vicarious liability claim, and defendants’ substantial non-infringing use defense. Defendants argue generally that plaintiffs’ request is unduly burdensome because producing the enormous amount of information in the Logging database (about 12 terabytes of data) “would be expensive and time-consuming, particularly in light of the need to examine the contents for privileged and work product material.” 

And. 



Defendants argue that the data should not be disclosed because of the users’ privacy concerns, saying that “Plaintiffs would likely be able to determine the viewing and video uploading habits of YouTube’s users based on the user’s login ID and the user’s IP address”. But defendants cite no authority barring them from disclosing such information in civil discovery proceedings, and their privacy concerns are speculative.

Received on Friday, 12 October 2012 08:51:56 UTC